296,202
Total vulnerabilities in the database
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
| Software | From | Fixed in |
|---|---|---|
| xmldom_project / xmldom | 0.9.0-beta1 | 0.9.0-beta1.x |
| xmldom_project / xmldom | 0.8.0 | 0.8.3 |
| xmldom_project / xmldom | 0.7.0 | 0.7.6 |
| xmldom_project / xmldom | - | 0.6.0.x |
| debian / debian_linux | 10.0 | 10.0.x |